CVE-2026-61205 in PeopleSoft Enterprise SCM Purchasing
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise SCM Purchasing version 9.2, specifically affecting the purchasing component of the broader PeopleSoft suite. The flaw represents a critical security weakness that enables unauthenticated attackers to gain unauthorized access to sensitive business data through standard HTTP network connections. The vulnerability's exploitability is classified as easily accessible, meaning that threat actors with minimal technical expertise can leverage this weakness without requiring authentication credentials or specialized tools. The attack vector specifically targets HTTP protocols, indicating that the vulnerability likely stems from improper input validation or authentication mechanisms within the web application layer of the purchasing module.
The technical nature of this vulnerability allows for comprehensive data manipulation capabilities including unauthorized creation, deletion, and modification of critical business data within the PeopleSoft SCM Purchasing system. Additionally, attackers can achieve unauthorized read access to sensitive subsets of data that would normally be restricted to authorized personnel only. This dual impact on both integrity and confidentiality creates significant operational risks for organizations relying on this financial management module. The CVSS 3.1 scoring system rates this vulnerability at 8.2 out of 10, with particular emphasis on the high integrity impact and moderate confidentiality impact, reflecting the substantial potential for data corruption and business disruption that could result from exploitation.
The operational implications of this vulnerability extend beyond simple data theft or modification to encompass potential business continuity risks and regulatory compliance violations. Organizations utilizing PeopleSoft SCM Purchasing may face unauthorized access to procurement records, vendor information, purchase orders, and financial transaction data that could compromise competitive positioning and financial integrity. From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic case of insufficient authentication mechanisms within web applications. The attack surface is particularly concerning given that the vulnerability operates at the network level without requiring any prior authentication, making it particularly attractive to automated exploitation tools.
Organizations should implement immediate mitigations including network-level access controls such as firewalls and intrusion detection systems to restrict HTTP access to the affected application. Patch management processes must be prioritized to ensure timely deployment of Oracle security patches addressing this vulnerability. The ATT&CK framework categorizes this type of vulnerability under T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS), highlighting the need for comprehensive network monitoring and application security controls. Additional security measures should include implementing robust authentication mechanisms, regular vulnerability assessments, and establishing incident response procedures specifically tailored to address unauthorized access scenarios in enterprise financial systems.